CVE-2026-55386 Details
Description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.
A SQL injection vulnerability has been identified in InvoiceShelf versions prior to 2.4.0. The issue arises because the application passes the authenticated user's 'orderByField' query parameter directly into Laravel's 'orderBy' method without validating the value. This oversight allows crafted SQL expressions to be injected into the ORDER BY clause of invoice and other list endpoints, facilitating boolean-based blind extraction of database information. The vulnerability affects all models that implement 'scopeApplyFilters()' and is inherited from Crater Invoice.
Users can upgrade to InvoiceShelf version 2.4.0, where this vulnerability has been fixed. Instructions for downloading this version are available on the InvoiceShelf GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/pull/663 | [email protected] | Source CodeVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvoiceShelf | < 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | New CVE Received | [email protected] |
| Oct 14, 2026 | CVE Modified | CISA-ADP |